CVE-2023-5752: Mercurial configuration injectable in repo revision when installing via pip
Mercurial configuration injectable in repo revision when installing via pip
Other sources
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
— NVD
When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pipto a version that resolves this vulnerability.Fixed in 23.3 - Upgrade
Upgrade
redhat/pipto a version that resolves this vulnerability.Fixed in 23.3 - Upgrade
Upgrade
pipto a version that resolves this vulnerability.Fixed in 23.3 - Compensating control
If you cannot upgrade pip to v23.3 or later, avoid installing packages from Mercurial VCS URLs (e.g., 'pip install hg+...') because pip prior to v23.3 can use the specified Mercurial revision to inject arbitrary '--config' options into the 'hg clone' call.
Event History
Frequently Asked Questions
What is CVE-2023-5752?
CVE-2023-5752 is a vulnerability in the pip package manager that allows an attacker to inject arbitrary configuration options during package installation.
How does CVE-2023-5752 impact users?
CVE-2023-5752 can be exploited by an attacker to modify the Mercurial configuration during package installation, potentially compromising the integrity and security of the system.
What is the severity of CVE-2023-5752?
The severity of CVE-2023-5752 is medium, with a severity value of 5.5.
How can I fix CVE-2023-5752?
To fix CVE-2023-5752, users should update their pip package manager to version 23.3 or higher.
Where can I find more information about CVE-2023-5752?
You can find more information about CVE-2023-5752 on the GitHub pull request, the Python security-announce mailing list, and the NIST National Vulnerability Database.